CWE-696 Incorrect Behavior Order

Docling imports plugin entry points before the allow_external_plugins check

External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

Russh: Channel-scoped server callbacks can be reached without an open channel

GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor

OpenStack Ironic: Pre-Validation Checksum Calculation allows Denial of Service (DoS) via Infinite Block Devices

OpenStack Horizon has Incorrect Behavior Order

kanidmd_lib: Image upload validators run before authorization; PNG validator panics on malformed input

Duplicate Advisory: OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation

Duplicate Advisory: OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete

Duplicate Advisory: OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement

OpenClaw: Mattermost callback dispatch allowed non-allowlisted sender actions

GraphQL grant on a property might be cached with different objects

Authorization bypass in Quarkus

Potential DoS via the Tudoor mechanism in eventlet and dnspython

ibc-go: Potential Reentrancy using Timeout Callbacks in ibc-hooks

Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime

Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime

A potential Denial of Service issue in protobuf-java

skylot jadx affected by Incorrect Behavior Order in vulnerable dependency

Padding Oracle Attack due to Observable Timing Discrepancy in jose